CVE-2024-10343 is a stored cross-site scripting vulnerability in the Beek Widget Extention WordPress plugin (up to version 0.9.5). The issue arises from insufficient input sanitization and output escaping of user-supplied attributes in shortcodes, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts into pages. These scripts execute in the context of any user who accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, indicating a medium severity impact. There is no information about an available patch or vendor advisory confirming remediation.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the Beek Widget Extention plugin if possible. Monitor for updates from the plugin vendor or WordPress plugin repository for a security update addressing this vulnerability.